LoFP / powershell scripts that use this capability for troubleshooting.

Techniques

• T1003
• T1059

Sample rules

PowerShell MiniDump Script

• source: elastic
• technicques:
  • T1003
  • T1059

Description

This rule detects PowerShell scripts capable of dumping process memory using WindowsErrorReporting or Dbghelp.dll MiniDumpWriteDump. Attackers can use this tooling to dump LSASS and get access to credentials.

Detection logic

event.category:process and host.os.type:windows and powershell.file.script_block_text:(MiniDumpWriteDump or MiniDumpWithFullMemory or pmuDetirWpmuDiniM) and not user.id : "S-1-5-18"